mnemonic-utils@1.0.1

Analysis

The postinstall hook (postinstall.js) runs on install and harvests the victim's credentials and crypto wallets. It reads ~/.env, ~/.env.local, ~/.env.production, ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, then recursively scans every dot-directory in the home folder for files whose names match wallet, key, secret, seed, mnemonic, keystore, or private, or that end in .json or .pem (files under 50KB). It bundles these contents together with the hostname and username and POSTs them as JSON to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. This exfiltrates SSH private keys, cloud credentials, npm tokens, and Solana/Ethereum wallet keys to a third-party webhook endpoint.